Bug 2461544 (CVE-2026-31644)

Summary: CVE-2026-31644 kernel: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `lan966x` network driver. When the `lan966x_fdma_reload()` function encounters an error during the allocation of new receive (RX) buffers, it can lead to a use-after-free condition. This occurs because the system may attempt to restart Direct Memory Access (DMA) operations using memory pages that have already been released. Consequently, the hardware might write data into memory regions that are now allocated to other kernel components, potentially causing memory corruption. This could enable a local attacker to achieve privilege escalation or trigger a system crash (Denial of Service).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-24 15:07:39 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()

When lan966x_fdma_reload() fails to allocate new RX buffers, the restore
path restarts DMA using old descriptors whose pages were already freed
via lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can
release pages back to the buddy allocator, the hardware may DMA into
memory now owned by other kernel subsystems.

Additionally, on the restore path, the newly created page pool (if
allocation partially succeeded) is overwritten without being destroyed,
leaking it.

Fix both issues by deferring the release of old pages until after the
new allocation succeeds. Save the old page array before the allocation
so old pages can be freed on the success path. On the failure path, the
old descriptors, pages and page pool are all still valid, making the
restore safe. Also ensure the restore path re-enables NAPI and wakes
the netdev, matching the success path.
Comment 1 Keith Grant 2026-04-24 21:34:55 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026042458-CVE-2026-31644-34ba@gregkh/T